Session.php (3797B)
1 <?php 2 3 /** 4 * Session class 5 * 6 * handles the session stuff. creates session when no one exists, sets and gets values, and closes the session 7 * properly (=logout). Not to forget the check if the user is logged in or not. 8 */ 9 class Session 10 { 11 /** 12 * starts the session 13 */ 14 public static function init() 15 { 16 // if no session exist, start the session 17 if (session_id() == '') { 18 session_start(); 19 } 20 } 21 22 /** 23 * sets a specific value to a specific key of the session 24 * 25 * @param mixed $key key 26 * @param mixed $value value 27 */ 28 public static function set($key, $value) 29 { 30 $_SESSION[$key] = $value; 31 } 32 33 /** 34 * gets/returns the value of a specific key of the session 35 * 36 * @param mixed $key Usually a string, right ? 37 * @return mixed the key's value or nothing 38 */ 39 public static function get($key) 40 { 41 if (isset($_SESSION[$key])) { 42 if (is_string($_SESSION[$key])) { 43 // filter the value for XSS vulnerabilities 44 Filter::XSSFilter($_SESSION[$key]); 45 return $_SESSION[$key]; 46 } 47 else { 48 return $_SESSION[$key]; 49 } 50 } 51 } 52 53 /** 54 * adds a value as a new array element to the key. 55 * useful for collecting error messages etc 56 * 57 * @param mixed $key 58 * @param mixed $value 59 */ 60 public static function add($key, $value) 61 { 62 $_SESSION[$key][] = $value; 63 } 64 65 /** 66 * deletes the session (= logs the user out) 67 */ 68 public static function destroy() 69 { 70 session_destroy(); 71 } 72 73 /** 74 * update session id in database 75 * 76 * @access public 77 * @static static method 78 * @param string $userId 79 * @param string $sessionId 80 * @return string 81 */ 82 public static function updateSessionId($userId, $sessionId = null){ 83 84 $database = DatabaseFactory::getFactory()->getConnection(); 85 $sql = "UPDATE users SET session_id = :session_id WHERE user_id = :user_id"; 86 87 $query = $database->prepare($sql); 88 $query->execute(array(':session_id' => $sessionId, ":user_id" => $userId)); 89 90 } 91 92 /** 93 * checks for session concurrency 94 * 95 * This is done as the following: 96 * UserA logs in with his session id('123') and it will be stored in the database. 97 * Then, UserB logs in also using the same email and password of UserA from another PC, 98 * and also store the session id('456') in the database 99 * 100 * Now, Whenever UserA performs any action, 101 * You then check the session_id() against the last one stored in the database('456'), 102 * If they don't match then log both of them out. 103 * 104 * @access public 105 * @static static method 106 * @return bool 107 * @see Session::updateSessionId() 108 * @see http://stackoverflow.com/questions/6126285/php-stop-concurrent-user-logins 109 */ 110 public static function isConcurrentSessionExists(){ 111 112 $session_id = session_id(); 113 $userId = Session::get('user_id'); 114 115 if(isset($userId) && isset($session_id)){ 116 117 $database = DatabaseFactory::getFactory()->getConnection(); 118 $sql = "SELECT session_id FROM users WHERE user_id = :user_id LIMIT 1"; 119 120 $query = $database->prepare($sql); 121 $query->execute(array(":user_id" => $userId)); 122 123 $result = $query->fetch(); 124 $userSessionId = !empty($result)? $result->session_id: null; 125 126 return $session_id !== $userSessionId; 127 } 128 129 return false; 130 } 131 132 /** 133 * Checks if the user is logged in or not 134 * 135 * @return bool user's login status 136 */ 137 public static function userIsLoggedIn() 138 { 139 return (self::get('user_logged_in') ? true : false); 140 } 141 }